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Description 

FIELD OF THE INVENTION 

This invention relates to the data processing field. 5 
More specifically, this invention is an event handling 
mechanism that categorizes the events of a raw event 
stream into groups of events and associates an action 
or actions with each group. 

BACKGROUND OF THE INVENTION 

The system software of today's single and multiple 
processor environments usually includes a crude event 
handling mechanism. The purpose of this mechanism 
is to provide some degree of control for the potentially 
large amount of event traffic on the system's communi- 
cation networks. It is the responsibility of an event han- 
dling mechanism to route and/or coordinate the event 
traffic to best utilize the resources of the system. Exist- 
ing event handler implementations perform various op- 
erations on an event stream. Examples include the de- 
letion, logging, and/or display of certain events, usually 
on a system console monitored by a system administra- 
tor. These event handlers are "hard coded" to handle 
particular events and particular streams of events. 
When new events are added to an event stream, major 
modifications to the event handler must in turn be made 
to accommodate them. In some cases an entire new 
event handler is requ ired. A new event handler is almost 
always required whenever support for a new or different 
event stream protocol is desired. This situation is further 
complicated when one considers a system that supports 
multiple event streams and thus includes multiple event 
handlers. In this latter system, the addition of a newly 
supported protocol not only means that a new event 
handler is required, but it also means that the software 
that coordinates the event handlers must also be rewrit- 
ten. 

The result of the cost and complexity associated 
with these modifications is the inability to provide signif- 
icant function to the end user (e.g., system administra- 
tor). For the most part, the example functions cited 
above (i.e., deletion, logging, and display on a system 
console) typify current event handler implementations. 
This limited function in turn results in several problems: 
entire categories of events must be deleted to accom- 
modate more important categories, some events are 
never seen because the system console is unattended 
when an event appears, and logs are so large that it is 
difficult to detect events of significance. In general, this 
makes the system administrator task more difficult be- 
cause that person has only limited control over a large 
portion of the information necessary to perform their job. 

An article of the IBM TDB vol.34 no.5 October 1 991 , 
page 415-417, relates to a process for real time, trace- 
driven performance monitors. This process is driven by 
a "trace" or log of system events, such as the traces that 



are available in the AIX operating system (IBM regis- 
tered trademarks). 

An international application WO 93 /00632, pub- 
lished on 07.01 .93 and falling within the terms of Article 
54(3) EPC, relates to a method and system for monitor- 
ing and changing the operation of a computer system 
which comprises a plurality of computers in a local area 
network or a plurality of interconnected local area net- 
work. The monitoring and changing may concern error 
processing for instance error detecting, registering and 
rectifying occurring during the operation of a computer 
system. In this process, the method and system consist 
in using at least one event report generator in each pro- 
gram which is executable in the computer system and 
whose execution is monitored depending on a flexible 
rule base which is included in an event processing ma- 
chine and which associates a certain event with a pre- 
determined action for determining the action associated 
with the reported event. But the techniques disclosed 
therein does not enable to reduce the cost management 
of a computer system's event streams. 

US Patent Application US-A-4 965 772 (Daniel et 
al.) entitled "Method and Apparatus for Communication 
Network Alert Message Construction" discloses con- 
struction and display of operator messages represent- 
ative of alert conditions in a network. Code points, which 
are strings of bits, are generated in response to an event 
in a device attached to the network. The code points are 
used to index predefined tables that contain relatively 
short units of text messages in operator selectable lan- 
guages to be used in building an operator's information 
display. A product attached to a network, an alert send- 
er, will generate a series of code points representative 
of desired display messages for an operator The mes- 
sages are independent of the specific alert sending 
product insofar as an alert receiver is concerned. The 
operator can also choose between detailed and general 
display messages. The code points are hierarchically 
arranged so that if the alert receiver does not have the 
most up to date set of messages, the alert receiver will 
display a more generic message which is still represen- 
attaive of the event. 

SUMMARY OF THE INVENTION 

It is a principle object of this invention to provide for 
the effective, efficient, and cost reduced management 
of a computer system's event streams. 

It is another object of this invention to provide the 
system administrator with the ability to dynamically cat- 
egorize and re-categorize the events of a system's 
event stream(s). 

It is still another object of this invention to provide 
the system administrator with the ability to dynamically 
modify how the system processes particular events or 
groups of events without having to change how the 
events have been categorized. 

These and other objects are accomplished by the 
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event handler mechanism laid down in the independent 
claims. Further enhancements are provided by the sub- 
claims. 

Computer systems have the ability to monitor their 
components and operations, generate events which in- 
dicate the occurrence of a monitored condition (e.g. out 
of paper, Joe Smith just signed on, disk utilization near- 
ing capacity, etc.), and process these events in some 
manner. 

The present invention provides significant en- 
hancements to the latter capability. 

The events of an event stream or streams are "fil- 
tered" into categories or groups of events. Once cate- 
gorized, the invention associates an action or actions 
with the categorized event. The associated action can 
be logging the event, routing the event to the electronic 
address of a user, or sending the event to an application 
program for further processing. 

The filtering process is accomplished through the 
use of four discrete components: a filter table, a filter 
table maintenance mechanism, a parsing mechanism, 
and a filter table processing mechanism. The filter table 
is maintained by the system administrator, and contains 
a plurality of filter entries. The filter entries in turn contain 
a sequence number, a group identifier, and certain se- 
lection criteria. The selection criteria includes a collec- 
tion of element types, values, and operators. The sys- 
tem administrator uses the filter table maintenance 
mechanism to create, modify, and delete both the filter 
entries and the filter table itself. In doing so, the system 
administrator is given the ability to categorize all events 
of an event stream. 

The parsing mechanism parses out select elements 
of each event contained in a raw event stream. These 
elements then comprise a standardized event. The 
parsing mechanism produces the same standardized 
event regardless of the form of the events in the raw 
event stream. The filter table processing mechanism 
then takes the selection criteria of the filter entries and 
applies them to the element types and values of the 
standardized event. If a match is detected, the group 
identifier is passed to the action mechanism of the in- 
vention. If not, a default group identifier is passed on. 

The action mechanism of the invention entails three 
discrete components: an action table, an action table 
maintenance mechanism, and an action table process- 
ing mechanism. The action table is maintained by the 
system administrator. The action table contains a plu- 
rality of group entries. The group entries are used when 
groups are provided by the filtering process discussed 
above, or when an application program supplies cate- 
gorized events to this portion of the invention. The group 
entries contain a group identifier and associated ac- 
tions, such as routing the event to an electronic address 
or another application program. 

The system administrator will use the action table 
maintenance mechanism to create, modify, and delete 
the group entries, event entries and the action table it- 



self. In doing so, each event or group of events will be 
acted upon in the same manner. 

In operation, the action table processing mecha- 
nism will attempt to match the subject group or event 

s with a group or event entry in the action table. If there 
is a match, the action table processing mechanism will 
route the event to an application program or the elec- 
tronic address of one or more end users. If there is not 
a match, the action table processing mechanism will 

10 route the event to a default destination such as the sys- 
tem console or "bit bucket". 

BRIEF DESCRIPTION OF THE DRAWINGS 

15 Fig. 1 shows the computer system of the invention. 
Fig. 2 shows the process flow of the preferred em- 
bodiment. 

Fig. 3 shows the two logical functions of the pre- 
ferred embodiment and their interaction with the system 
20 administrator. 

Fig. 4 shows the process flow of the filter table and 
action table maintenance mechanisms of the preferred 
embodiment. 

Figs. 5 and 7 depict the user interface of the pre- 
25 ferred embodiment. 

Figs. 6 and 8 show how the user's input is manipu- 
lated after its entry. 

Fig. 9 shows the table structure of the invention. 
Fig. 11 shows an example event that could be han- 
30 died by the invention. 

Fig. 12 shows an exemplary result of the initial 
parsing step. 

Figs. 10, 13, and 14 are flow diagrams describing 
the processes of the preferred embodiment. 
35 Fig. 1 5 depicts an alternate embodiment of the in- 
vention. 

DESCRIPTION OF THE PREFERRED EMBODIMENT 

40 Fig. 1 shows a block diagram of the computer sys- 
tem 10 of the invention. Computer system 10 contains 
storage 11, CPU 12, memory 13, event monitor 14, 
event generator 15, event handler 16, and communica- 
tions interface 20. Although the discussion of the pre- 

45 ferred embodiment focuses on events received from 
communications interface 20, it is important to note that 
the invention also applies equally to events received 
from other internal entities that are capable of generat- 
ing events. 

50 Fig. 1 also shows connections to other computer 
systems 21 via communications line 22. The invention 
itself is located in event handler 16. Event handler 16 
contains filter mechanism 17, action mechanism 18, and 
editor 1 9. 

55 in the preferred embodiment, computer system 10 
is an Application System/400 (IBM registered trade- 
mark) midrange computer system, although other com- 
puter systems such as personal computers and main- 
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frame computer systems could also be used. In addition, 
communications line 22 could be a direct connection ca- 
ble, a local area network, telecommunications link, or 
other form of operatively connecting computers togeth- 
er. 

Referring now to Fig. 2, events 25 are shown as in- 
put to event handler 1 6 of the invention. Events 25 could 
represent any type of event stream. All possible events 
that can be generated by event generator 15 and sent 
to event handler 16 in a continuous or discontinuous 
fashion as computer system 10 is operating will be re- 
ferred to herein as an event stream. When each event 
encounters filter 17, it is labeled as being a member of 
a particular event group 27. The invention then uses the 
event group label (event group 27) and action table 28 
to decide what actions 29 are appropriate for this event 
25. The various actions 29 are then performed by the 
system. 

Fig. 3 shows event handler 16 in more detail. As 
mentioned above, the events of raw event stream 25 
first encounter filter mechanism 17. The filter process 

34 uses a filter table 32 to filter (or label as mentioned 
above) the events into an event group 35. Filter table 32 
contains filter entries 33. These filter entries are used to 
determine which event group is appropriate for the sub- 
ject event. Once this determination is made, event group 

35 is passed on to action process 39. To decide what 
actions are required, the action process 39 compares 
the group entries 38 of the action table 37 to the event 
group 35. Action executer 41 then uses this information 
to execute the actions. 

Fig. 3 further depicts the ability of the system ad- 
ministrator 36 to create and modify the filter table 32 and 
the action table 37. A "system administrator" referred to 
herein is normally one or more persons responsible for 
the continued operation of computer system 10. If com- 
puter system 10 is a personal computer, the user of the 
personal computer or the person responsible for the 
continued operation of the local area network would be 
considered to be the system administrator. Fig. 4 de- 
scribes this ability in more detail. 

Referring now to Fig. 4, the system administrator 
would first elect to work with the event handler function 
40. The system administrator can choose which filter to 
work with and what type of filter he or she would like it 
to be. These choices are significant in that they give the 
system administrator control over what filters are used 
for what purposes. This flexibility is important because 
the event handler of the preferred embodiment utilizes 
different filter tables in different situations. Next, the sys- 
tem administrator must elect to work with the action ta- 
ble 49 or work with the filter table 42. Once the choice 
has been made, the system administrator can create , 
change, delete, or print either of the two logical con- 
structs (i.e. the filter table or the action table). Another 
option at this level is the ability to perform operations on 
the entries of either of the logical constructs 44 and 45. 
An entry can be added, copied, changed, removed, 



displayed , or renamed, 46 and 47. 

Fig. 5 depicts the screen that is seen when the sys- 
tem administrator elects to work with the filter table's en- 
tries. Each filter entry contains a sequence number 50, 
5 a group identifier (group 51 ), and selection criteria (se- 
lection data 52). Sequence number 50 is used to control 
the order in which the filter table is searched. Group 
identifier 51 represents the category in which events can 
be placed. The selection criteria 52 is used to determine 
the category in which the subject event belongs. It does 
so, by using the elements of each event. In particular, 
the selection criteria is used to determine whether an 
event's element types and the associated values satisfy 
the test set forth in the selection criteria itself. Boolean 
expressions which include relational operators, Boolean 
operators, or both are used to create the "test" of the 
selection criteria. 

Fig. 6 depicts the expression flow of the screen 
shown in Fig. 5. The add filter entry function 60 converts 
the user information into a device specific data format 
63. In the preferred embodiment, the use of the add filter 
entry function 60 results in the information being parsed 
61 and then converted into an optimized form 62. The 
preferred embodiment uses a generic parser which first 
converts the expression into an infix binary expression 
tree containing relational and Boolean operators. The 
filter table parser then converts the tree into a prefix data 
stream for high performance string-based evaluation. 
The device specific data format 63 is a single stream 
prefix expression that contains a length, a Boolean or 
relational operator, and the right and left sub-expres- 
sions recursively listed. The single stream representa- 
tion containing lengths and recursive expressions al- 
lows for optimized evaluations by reducing the number 
of sub-expression evaluations needed. It is in this fash- 
ion that the system administrator's categorization 
scheme is represented in the filter table 64. 

Fig. 7 depicts the screen that is seen when the sys- 
tem administrator elects to work with the action table's 
entries. Each action table entry contains a group iden- 
tifier (group 70) and at least one associated action 71 . 
Associated actions can be routing the event to one or 
more electronic addresses of specific users, logging the 
event in a specific log, or sending the event to an appli- 
cation program , as shown in Fig. 7. 

Fig. 8 depicts the expression flow of the screen 
shown in Fig. 7. In the preferred embodiment, the use 
of the add group entry function 80 results in the infor- 
mation being converted into a generic form 81 and then 
into an optimized form 82. The data's resultant form is 
device specific 83. 

It is in this fashion that the system administrator's 
action association scheme is represented in action table 
84. In the preferred embodiment, the add group entry 
function 80 converts the specific action (parameter) in- 
formation 85 into generic actions ((action 1 , parameter 
1 )... (action N, parameter N)) format 81 . The generic for- 
mat 81 allows the add group entry function 80 to convert 
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any action into the internal device specific data 83. 

The internal device representation 83 identifies the 
data as a group entry which identifies the group (cate- 
gory), and lists the actions and parameters. 

Fig. 9 shows the combined filter table/action table 
structure 90 of the preferred embodiment. Though it is 
conceptually easier to think of the filter table and action 
table as separate data structures, they are actually com- 
bined into a single data structure in the preferred em- 
bodiment. In the preferred embodiment, keys for filter 
93 and group entries 92 are placed in index 91 . When 
retrieval is needed, the offsets in the index are used to 
gain access to the data area 94 where the data 95 is 
stored. 

Fig. 10 depicts the four conceptual entities of the 
filter process (first described as the filter function at 17 
in Fig. 1). The filter processing and filter maintenance 
mechanism (103, 106) were explained in the discussion 
of Figs. 4, 5, 6. The parsing mechanism 101 is respon- 
sible for convert ing the raw data events 100 into stand- 
ardized events 102. The event of Fig. 11 is an example 
of what an event could look like prior to parsing. As was 
mentioned in the discussion of Fig. 5, the filter table's 
selection criteria is primarily concerned with the event's 
element types 111 and the associated values 112. 
Hence, it is the parsing mechanism's task to parse out 
the important elements and assign them a type. It is par- 
ticularly important that this is done consistently regard- 
less of the type of event received. An example is shown 
in Fig. 12 where only those elements that are actually 
needed are placed into the standardized event. Return- 
ing now to Fig. 10, it is seen t hat the standardized event 
is presented to the filter processing mechanism 103. 
The filter processing mechanism 1 03 will use the selec- 
tion criteria of the filter entries from filter table 1 05 to 
discern a match. Once accomplished, the filter process- 
ing mechanism 103 will pass the group identifier (event 
group 104) to the action processing function. 

Fig. 13 describes action processing (first described 
as action mechanism 18 in Fig. 1). The action table 
processing and action table maintenance mechanism 
(131, 134) were described in the discussion regarding 
Figs. 4, 7, and 8. The action table processing mecha- 
nism 1 31 uses the event group passed to it by the filter 
table processing mechanism to locate the appropriate 
action 1 32 contained in the action table 1 33. Once lo- 
cated, the action table processing mechanism 131 
passes the action 1 32 on to be executed as indicated. 

Fig. 14 is a flow diagram that shows the steps used 
by the filter processing 1 48 and the action table process 
ing 149 mechanisms and how the two mechanisms in- 
teract. The filter processing mechanism begins by re- 
trieving the first filter entry at block 140. The filter 
processing mechanism will the n traverse the expres- 
sion tree of Fig. 6 and attempt to locate a match 141 . If 
a match is achieved, the associated group identifier is 
passed to the action table processing mechanism 149. 
If a match is not found, the next filter entry is retrieved 



at block 143 and the process is repeated. If a match is 
not achieved before the last filter entry is evaluated, a 
default group identifier (which automatically "matches- 
events not matched by other entries) is used. When the 

5 action table processing mechanism 149 receives the 
group identifier, it will attempt to locate the correct group 
entry in the action table 144. If the group identifier exists 
within the action table, the associated action is executed 
by block 147. If the group identifier does not exist within 

io the action table, a default entry is used in block 1 46. This 
results in a default action being passed on to block 147. 

Fig. 1 5 depicts one possible alternate embodiment. 
In this embodiment, a filter process could be used with- 
out the companion action processing. The application 

is program 1 50 would receive the event groups 1 52 direct- 
ly and perform both the action association function and 
action execution function. Although this embodiment 
does not provide the flexibility of the preferred embodi- 
ment, it still represents an improvement over existing im- 

20 plementations. The system administrator 151 retains 
the flexibility of being able to control how events are to 
be categorized. 



25 Claims 

1. A method for handling events in a data processing 
system's event stream (25), said method compris- 
ing the steps of: 

30 

accepting as input a user created categoriza- 
tion scheme, said user created categorization 
scheme being used to construct a filter table 
(32) receiving as input said events; 

35 

applying said events to said filter table; and 

categorizing said events into groups of events 
based on a comparison of characteristics of 
40 said events with information contained in said 

filter table. 

2. The method of claim 1 wherein the accepting step 
of said user categorization scheme further compris- 
es es the steps of: 

accepting as input a modified user categoriza- 
tion scheme; and 

50 parsing said user input into a device specific 

representation. 

3. The method of claim 2 wherein said accepting step 
further comprises the step of: 

55 

inputting a plurality of sequentially arranged fil- 
ter entries (33) into said filter table (32). 
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4. The method of claim 3 wherein said inputting step 
further comprises the step of: 

adding a group identifier, a sequence number, 
and a set of selection criteria to each of said 
filter entries. 

5. The method of claim 4 wherein said adding step fur- 
ther comprises the step of: 

entering, as part of said selection criteria a set 
of element types, values, and operators. 

6. The method of claim 5 where in said entering step 
further comprises the step of: 

placing a wild card character identifier into said 
value. 

7. The method of claim 1 wherein said applying step 
further comprises the step of: 

parsing said events into standardized events. 

8. The method of claim 6 wherein said categorizing 
step further comprises the steps of: 

using said sequence numbers to search 
through said filter entries; 

matching said element types and said values 
to a particular element's type and value; and 

interpreting said wild card character identifiers. 

9. The method of any one of the previous claims fur- 
ther comprising the steps of: 

accepting as input a user created action asso- 
ciation scheme, said action association 
scheme being used to construct an action table 
(37); 

receiving as input an event group; 

applying said event group to said action table 
to determine said particular actions, said par- 
ticular actions being determined by comparing 
characteristics of said event group with infor- 
mation contained in said action table; and 

outputting said particular actions to an applica- 
tion program for further processing. 

10. The method of claim 9 wherein said outputting step 
further comprises: 

sending said particular actions to a person lo- 



cated at an electronic address on a computer 
system. 

11. The method of claim 9 wherein said action table 
5 construction step further comprises the steps of: 

accepting user input to create and modify said 
action association scheme; and 

10 parsing said user input into a device specific 

representation. 

12. The method of claim 11 wherein said action table 
construction step further comprises the step of: 

15 

inputting a plurality of group entries into an ac- 
tion table. 

13. The method of claim 12 wherein said group entries 
20 inputting step further comprises the step of: 

adding a group identifier and actions to each of 
said group entries. 

25 14. The method of claim 1 3 wherein said action deter- 
mining step further comprises the steps of: 

using said group identifiers to search through 
said group entries: and 

30 

matching said group identifier to a particular 
group's type. 

1 5. An apparatus for handling events in a data process- 
es ing system's event stream (25), said apparatus 

comprising: 

means for accepting as input a user created 
categorization scheme, said user created cat- 
40 egorization scheme being used to construct a 

filter table (32) receiving as input said events; 

means for applying said events to said filter ta- 
ble: and 

45 

means for categorizing said events into groups 
of events based on a comparison of character- 
istics of said events with information contained 
in said filter table (32). 

50 

16. The apparatus of claim 15 wherein said means for 
accepting said user categorization scheme further 
comprises: 

ss means for accepting user input to construct and 

modify said categorization scheme. 

17. The apparatus of claim 16 wherein said means for 
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accepting user input further comprises: 

means for parsing said user input into a device 
specific representation. 

18. The apparatus of claim 1 7 wherein said filter table 
comprises a plurality of sequentially arranged fitter 
entries (33), each of said filter entries comprising a 
group identifier, a sequence number, and a set of 
selection criteria. 

19. The apparatus of claim 18 wherein said set of se- 
lection criteria comprises a set of element types, 
values, and operators,, said operators being rela- 
tional 

20. The apparatus of claim 1 9 wherein said operators 
are Boolean. 

21 . The apparatus of claim 20 wherein said value com- 
prises a wild card character identifier 

22. The apparatus of claim 15 wherein said means for 
accepting user input further comprises: 

means for parsing said events into standard- 
ized events. 

23. The apparatus of claim 21 wherein said means for 
applying further comprises: 

means for using s aid sequence numbers to 
search through said filter entries; 

means for matching said element types and 
said values to a particular element's type and 
value; and 

means for interpreting said wild card character 
identifiers. 

24. The apparatus according to any one of claims 1 5 to 
23 further comprising: 

means for accepting as input a user created ac- 
tion association scheme, said action associa- 
tion scheme being used to construct an action 
table (37); 

means for receiving as input an event group; 

means for applying said event group to said ac- 
tion table to determine said particular actions, 
said particular actions being determined by 
comparing characteristics of said event group 
with information contained in said action table; 
and 
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means for outputting said particular actions to 
an application program for further processing. 

25. The apparatus of claim 24 wherein a destination of 
s said means for outputting is a person located at an 

electronic address on a computer system. 

26. The apparatus of claim 24 wherein said action table 
construction means further comprises means for: 

w 

accepting user input to create and modify said 
action association scheme; and 

parsing said user input into a device specific 
is representation. 

27. The apparatus of claim 26 wherein said action table 
construction means further comprises means for: 

20 inputting a plurality of group entries into an ac- 

tion table. 

28. The apparatus of claim 27 wherein said means for 
inputting group entries further comprises means for: 

25 

adding a group identifier and actions to each of 
said group entries. 

29. The apparatus of claim 28 wherein said means for 
30 determining said particular actions further compris- 
es means for: 

using said group identifiers to search through 
said group entries; and 

35 

matching said group identifier to a particular 
group. 

40 PatentansprOche 

1. Eine Vorrichtung zur Ereignisbehandlung in einem 
Ereignisstrom (25) eines Datenverarbeitungssy- 
stems, folgende Schritte umfassend: 

45 

Akzeptieren eines von einem Benutzer einge- 
gebenen Kategorisierungsschemas als Einga- 
be, wobei das genannte vom Benutzer erstellte 
Kategorisierungsschema zur Erstellung einer 
50 Filtertabelle (32) verwendet wird, die als Einga- 

be die genannten Ereignisse erhalt; 

Anwenden der genannten Ereignisse auf die 
genannte Filtertabelle; und 

55 

Kategorisieren der genannten Ereignisse in 
Gruppen, basierend auf dem Vergleich von Ei- 
genschaften der genannten Ereignisse mit in 
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dergenannten Filtertabelle enthaltenen Daten. 

2. Eine Methode nach Anspruch 1 , bei der der Schritt 
des Akzeptierens des genannten vom Benutzer er- 
stellten Kategorisierungsschemas weiterhin folgen- 
de Schritte umfaGt: 

Akzeptieren eines geanderten Benutzer-Kate- 
gorisierungsschemas als Eingabe; und 

Syntaktisches Analysieren der genannten Be- 
nutzereingabe in einer geratespeztfischen Dar- 
stellung. 

3. Eine Methode nach Anspruch 2, bei der der ge- 
nannte Schritt des Akzeptierens weiterhin folgen- 
den Schritt umfaGt: 

Aufnehmen einer Vielzahl von sequentiell an- 
geordneten Filtereingaben (33) in die genannte 
Filtertabelle (32). 

4. Eine Methode nach Anspruch 3, bei der der ge- 
nannte Schritt der Aufnahme weiterhin folgenden 
Schritt umfaGt: 

Hinzufugen einer Gruppenkennung, einer Se- 
quenznummer und eines Satzes an Auswahl- 
kriterien zu jeder der genannten Filtereinga- 
ben. 

5. Eine Methode nach Anspruch 4, bei der der ge- 
nannte Schritt des Hinzufugens weiterhin folgen- 
den Schritt umfaGt: 

Eingeben eines Satzes an Elementtypen, Wer- 
ten und Operatoren als Teil der genannten Aus- 
wahlkriterien. 

6. Eine Methode nach Anspruch 5, bei der der ge- 
nannte Schritt der Eingabe weiterhin folgenden 
Schritt umfaGt: 

Plazieren einer Platzhalterkennung in den ge- 
nannten Wert. 

7. Eine Methode nach Anspruch 1, bei der der ge- 
nannte Schritt des Anwendens weiterhin folgenden 
Schritt umfaGt: 

Syntaktisches Analysieren der genannten Er- 
eignisse in standardisierte Ereignisse. 

8. Eine Methode nach Anspruch 6, bei der der ge- 
nannte Schritt des Kategorisierens weiterhin fol- 
gende Schritte umfaGt: 

Verwenden der genannten Sequenznummern 



14 

zum Durchsuchen der genannten Filtereinga- 
ben; 

Anpassen der genannten Elementtypen und 
5 der genannten Werte an einen speziellen Ele- 

menttyp und -wert; und 

Interpretieren der genannten Platzhalterken- 
nungen. 

10 

9. Eine Methode nach jedem der vorangegangenen 
Anspruche, weiterhin folgende Schritte umfassend: 

Akzeptieren eines vom Benutzer erstellten Ein- 
15 wirkungsassoziations-Schemas als Eingabe, 

wobei das genannte Einwirkungsassoziat ions- 
Schema zur Konstruktion einer Einwirkungsta- 
belle verwendet wird; 

20 Erhalten einer Ereignisgruppe als Eingabe; 

Anwenden der genannten Ereignisgruppe auf 
die genannte Einwirkungstabelle zur Bestim- 
mung der genannten speziellen Einwirkungen, 
25 wobei die genannten speziellen Einwirkungen 

durch einen Vergleich der Eigenschaften der 
genannten Ereignisgruppe mit den in der ge- 
nannten Einwirkungstabelle enthaltenen Daten 
bestimmt werden; und 

30 

Ausgeben der genannten speziellen Einwir- 
kungen an ein Anwendungsprogramm zur wei- 
teren Verarbeitung. 

35 10. Eine Methode nach Anspruch 9, bei der genannte 
Schritt der Ausgabe weiterhin folgenden Schritt um- 
faGt: 

Senden der genannten speziellen Einwirkun- 
40 gen an eine Person mit einer elektronischen 

Adresse in einem Computersystem. 

1 1 . Eine Methode nach Anspruch 9, bei der die genann- 
te Einwirkungstabellen-Konstruktion weiterhin fol- 
45 gende Schritte umfaGt: 

Akzeptieren der Benutzereingabe zur Erstel- 
lung und Anderung des genannten Einwir- 
kungsassoziations-Schemas; und 

50 

Syntaktisches Analysieren der genannten Be- 
nutzereingabe in einer geratespezifischen Dar- 
stellung. 

55 12. Eine Methode nach Anspruch 11, bei der die ge- 
nannte Einwirkullgstabellen-Konstruktion weiterhin 
folgenden Schritt umfaGt: 
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1 8. Eine Vorrichtung nach Anspruch 1 7, bei der die ge- 
nannte Fiftertabelle eine Vielzahl an sequentiell an- 
geordneten Filtereingaben (33) enthalt, wobei jede 
der genannten Filtereingaben eine Gruppenken- 
s nung, eine Sequenznummer und einen Satz an 
Auswahlkriterien umfaBt. 



Aufnahme einer Vielzahl von Gruppeneinga- 
ben in eine Einwirkungstabelle. 

13. Eine Methode nach Anspruch 12, bei der der ge- 
nannte Schritt der Aufnahme von Gruppeneinga- 
ben weiterhin folgenden Schritt umfaBt: 

Hinzuf Qgen einer Gruppenkennung und Einwir- 
kungen zu den genannten Gruppeneingaben. 

14. Eine Methode nach Anspruch 13, bei der der ge- 
nannte Schritt der Einwirkungsbestimmung weiter- 
hin folgende Schritte umfaBt: 

Verwenden der genannten Gruppenkennung 
zum Durchsuchen der genannten Gruppenein- 
gaben; und 

Anpassen der genannten Gruppenkennung an 
einen speziellen Gruppentyp. 

15. Eine Vorrichtung zur Ereignisbehandlung in einem 
Ereignisstrom (25) eines Datenverarbeitungssy- 
stems, wobei die genannte Vorrichtung weiterhin 
folgendes umfaBt: 

Ein Mittel zum Akzeptieren eines vom Benutzer 
erstellten Kategorisierungsschemas als Einga- 
be, das zur Konstruktion einer Filtertabelle (32) 
verwendet wird, die als Eingabedie genannten 
Ereignisse erhalt; 

Ein Mittel zum Anwenden der genannten Ereig- 
nisse auf die genannte Filtertabelle; und 

Ein Mittel zum Kategorisieren der genannten 
Ereignisse in Ereignisgruppen, basierend auf 
einem Vergleich der Eigenschaften der ge- 
nannten Ereignisse mit den in der genannten 
Filtertabelle (32) enthaltenen Daten. 

16. Eine Vorrichtung nach Anspruch 15, bei der die ge- 
nannten Mittel zum Akzeptieren des genannten 
vom Benutzer erstellten Kategorisierungsschemas 
weiterhin folgendes umfassen: 

Ein Mittel zum Akzeptieren von Benutzereinga- 
ben zur Konstruktion und Anderung des ge- 
nannten Kategorisierungsschemas. 

17. Eine Vorrichtung nach Anspruch 16, bei der die ge- 
nannten Mittel zum Akzeptieren der Benutzereinga- 
be weiterhin folgendes umfassen: 

Ein Mittel zum syntaktischen Analysieren der 
genannten Benutzereingabe in einer gerate- 
spezifischen Darstellung. 



19. Eine Vorrichtung nach Anspruch 1 8, bei der der ge- 
nannte Satz an Auswahlkriterien einen Satz an Ele- 

10 menttypen, Orten und Operatoren umfaBt, wobei 
die genannten Operatoren relational sind. 

20. Eine Vorrichtung nach Anspruch 1 9, bei der die ge- 
nannten Operatoren Boolesche Operatoren sind. 

is 

21 . Eine Vorrichtung nach Anspruch 20, bei der der ge- 
nannte Wert eine Platzhalterkennung umfaBt. 

22. Eine Vorrichtung nach Anspruch 1 5, bei der die ge- 
20 nannten Mittel zum Akzeptieren von Benutzerein- 

gaben weiterhin folgendes umfassen: 

Ein Mittel zum syntaktischen Analysieren der 
genannten Ereignisse in standardisierte Ereig- 
25 nisse. 

23. Eine Vorrichtung nach Anspruch 21 , bei der die ge- 
nannten Mittel zum Anwenden weiterhin folgendes 
umfassen: 

30 

Ein Mittel zum Verwenden der genannten Se- 
quenznummem zum Durchsuchen der ge- 
nannten Filtereingaben; 

35 Ein Mittel zum Anpassen der genannten Ele- 

menttypen und der genannten Werte an einen 
speziellen Elementtyp und -wert; und 

Ein Mittel zum Interpretieren der genannten 
40 Platzhalterkennungen. 

24. Eine Vorrichtung nach den Anspruchen 15 bis 23, 
weiterhin folgendes umfassend: 

45 in Mittel zum Akzeptieren eines vom Benutzer 

erstellten Einwirkungsassoziations-Schemas, 
wobei das genannte Einwirkungsassoziations- 
Schema zur Konstruktion einer Einwirkungsta- 
belle (37) verwendet wird; 

50 

Ein Mittel zum Erhaften einer Ereignisgruppe 
als Eingabe; 

Ein Mittel zum Anwenden der genannten Ereig- 
55 nisgruppe auf die genannte Einwirkungstabel- 

le, urn die genannten speziellen Einwirkungen 
festzulegen, wobei die genannten speziellen 
Einwirkungen durch einen Vergleich der Eigen- 
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schaften der genannten Ereignisgruppe mit 
den in der genannten Einwirkungstabelle ent- 
haltenen Daten bestimmt werden; und 

Ein Mittel zum Ausgeben der genannten spezi- 
ellen Einwirkungen an ein Anwendungspro- 
gramm zur weiteren Verarbeitung. 

25. Eine Vorrichtung nach Anspruch 24, bei der das Ziel 
der genannten Mittel zur Ausgabe eine Person mit 
einer elektronischen Adresse in einem Computer- 
system ist. 

26. Eine Vorrichtung nach Anspruch 24, bei der die ge- 
nannte Einwirkungstabellen-Konstruktion weiterhin 
folgende Mittel umfaBt: 

Ein Mittel zum Akzeptieren von Benutzereinga- 
ben zur Erstellung und Anderung des genann- 
ten Einwirkungsassoziations-Schemas; und 

Ein Mittel zum syntaktischen Analysieren der 
genannten Benutzereingabe in einer gerate- 
spezifischen Darstellung. 

27. Eine Vorrichtung nach Anspruch 26, bei der das ge- 
nannte Mittel zur Einwirkungstabellen-Konstruktion 
weiterhin folgendes Mittel umfaBt: 

Ein Mittel zum Aufnehmen einer Vielzahl von 
Gruppeneintragen in eine Einwirkungstabelle. 

28. Eine Vorrichtung nach Anspruch 27, bei der das ge- 
nannte Mittel zum Aufnehmen von Gruppeneintra- 
gen weiterhin folgendes Mittel umfaBt: 

Ein Mittel zum Hinzufugen einer Gruppenken- 
nung und Einwirkungen zu den einzelnen ge- 
nannten Gruppeneintragen. 

29. Eine Vorrichtung nach Anspruch 28, bei der die ge- 
nannten Mittel zum Bestimmen der speziellen Ein- 
wirkungen weiterhin folgendes Mittel umfassen: 

Ein Mittel zum Verwenden der genannten 
Gruppenkennungen zum Durchsuchen der ge- 
nannten Gruppeneintrage; und 

Ein Mittel zum Anpassen der genannten Grup- 
penkennungen an eine spezielle Gruppe. 



Revendicatlons 

1. Un precede de traitement d'evenements dans un 
flux d'ev6nements (25) d'un systeme de traitement 
de donnees, ledit procede comprenant les 6tapes 
consistant a : 



accepter comme entr6e un schema de catego- 
risation ayant 6te cree par I'utilisateur, ledit 
schema de categorisation cree par I'utilisateur 
etant utilise pour construire une table de filtre 
s (32) recevant comme entree lesdits ev6ne- 

ments; 

appliquer lesdits evenements a ladite table de 
filtre; et 

10 

classer en categorie lesdits evenements, en 
groupes evenements, en se basant sur une 
comparaison de caract6ristiques desdits eve- 
nements, avec reformation contenue dans la- 
15 dite table de filtre. 

2. Le proceed selon la revendication 1 , dans lequel la- 
dite 6tape d'acceptation dudit schema de classe- 
ment en categorie par I'utilisateur comprend en 

20 outre les 6tapes consistant a : 

accepter comme entr6e un schema de catego- 
risation utilisateur modifie pas ; et 

25 effectuer une analyse de ladite entr6e utilisa- 

teur, dans une representation specifique au dis- 
positif. 

3. Le procede selon la revendication 2, dans lequel la- 
30 dite etape d'acceptation comprend en outre l'6tape 

consistant a : 

introduce une plurality d'entr6es de filtre (33) 
agences sequentiellement dans ladite table de 
35 filtre (32). 

4. Le proced6 selon la revendication 3, dans lequel la- 
dite table d'entree comprend en outre I'etape con- 
sistant a : 

40 

ajouter un identificateur de groupe, un num6ro 
de sequence, et un jeu de criteres de selection 
a chacune desdites entrees de filtre. 

45 5. Le proced6 selon la revendication 4, dans lequel la- 
dite etape d'addition comprend en outre l'6tape con- 
sistant a : 

introduire comme partie dudit critere de s6lec- 
50 tion un jeu de types d'element, de valeurs et 

d'op6rateurs. 

6. Le proc6d6 selon la revendication 5, dans lequel la- 
dite etape d'int reduction comprenant en outre I'eta- 
55 pe consistant a : 

placer un identificateur de caractere joker dans 
ladite valeur. 
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7. Le proced6 selon la revendication 1 , dans lequel la- 
dite etape d'application comprend en outre I'etepe 
consistant a effectuer une analyse desdits ev6ne- 
ments en evenements standardises. 

5 

8. Le procede selon la revendication 6, dans lequel la- 
dite 6tape de categorisation comprend en outre une 
etape consistant a : 

utiliser lesdits numeraux de sequence pour fai- io 
re une recherche dans lesdites entr6es de f iltre; 

adapter lesdits types d'element et lesdites va- 
leurs a un type et a une valeur d'6!6ment parti- 
culiers; et is 

interpreter lesdits identificateurs de caractere 
joker. 

9. Le proced6 selon Tune quelconque des revendica- 20 
tions precedentes comprenant en outre les 6tapes 
consistant a : 

accepter comme entr6e un schema d'associa- 



1 0. Le proced6 selon la revendication 9, dans lequel la- 
dite etape d'envoi comprend en outre : 45 

I'envoi desdites actions particulieres a une per- 
sonne situee a une adresse electronique sur un 
systeme d'ordinateur. 

50 

11. Le procede selon la revendication 9, dans lequel la- 
dite etape de construction 6tape d'action comprend 
en outre les Stapes consistant a : 



une representation specrfique au dispositif. 

12. Le precede selon la revendication 11, dans lequel 
ladite etape de construction de table d'action com- 
prend en outre I'Stape consistant a : 

introduire une plurality d'entr6es de groupe 
dans une table d'action. 

13. Le procede selon la revendication 12, dans lequel 
ladite etape d'introduction d'entr6e de groupe com- 
prend en outre l'6tape consistant a : 

ajouter un identificateur de groupe et des ac- 
tions a chacune desdites entrees de groupe. 

14. Le proc6de selon la revendication 13, dans lequel 
ladite 6tape de determination d'action comprend en 
outre les 6tapes consistant a : 

utiliser lesdits identificateurs de groupe pour re- 
chercher dans lesdites entries de groupe; et 

adapter ledit identificateur de groupe a un type 
de groupe particulier. 

15. Un dispositif de traitement evSnements dans un flot 
de donn6es (25) d'un systeme de traitement de 
donnees, ledit appareil comprenant : 

des moyens pour accepter comme entree un 
schema de cat6gorisation cr6e par I'utilisateur, 
ledit schema de categorisation cree par I'utili- 
sateur etant utilis6 pourconstruire une table de 
filtre (32) recevant comme entree lesdits 6v6- 
nements; 

des moyens pour appliquer lesdits ev6nements 
a ladite table de filtre; et 

des moyens pour categoriser lesdits 6v6ne- 
ments en des groupes ev6nements, en se ba- 
sant sur une comparaison des caract6ristiques 
desdits 6v6nements avec I' information conte- 
nue dans ladite table de filtre (32). 

16. Le dispositif selon la revendication 15, dans lequel 
lesdits moyens d'acceptation dudit schema de ca- 
tegorisation utilisateur comprennent en outre : 

des moyens pour accepter I'entree utilisateur 
pour construire et modifier ledit schema de ca- 
tegorisation. 

17. Le dispositif selon la revendication 16, dans lequel 
lesdits moyens d'acceptation de I'entree utilisateur 
comprennent en outre : 



accepter une entree utilisateur pour creer et ss 
modifier ledit schema d'association d'action; et 

effectuer une analyse sur !'entr6e utilisateur, en 
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is 



tion d'action cree par I'utilisateur, ledit schema 25 
d'association d'action etant utilise pour cons- 
truire une table d'action (37); 

recevoir comme entr6e un groupe ev6ne- 
ments; 30 

appliquer ledit groupe evenements a ladite ta- 
ble d'action pour determiner lesdites actions 
particulieres, lesdites actions particulieres 
6tant determinees par une comparaison des 35 
caract6ristiques dudit groupe 6venements 
avec une information contenue dans ladite ta- 
ble d'action; et 

envoyer lesdites actions particulieres a un pro- 40 
gramme d'application pour continuer le traite- 
ment. 
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des moyens pour effectuer une analyse sur la- 
dite entree utilisateur, en une representation 
specifique au dispositif. 

18. Le dispositif selon la revendication 17, dans lequel 5 
iadrte etape de filtre comprend une plural ite d'entr6e 

de filtre (33) agencies sequentiellement, chacune 
desdites entrees de filtre comprenant un identifica- 
teur de groupe, un numero de sequence, et un jeu 
de criteres de selection. 10 

19. Le dispositif selon la revendication 18, dans lequel 
ledit jeu de criteres de selection comprend un jeu 
de types d'element, de valeurs, et d'operateurs, les- 
dits operateurs etant de type relationnel. is 

20. Le dispositif selon la revendication 19, dans lequel 
lesdits operateurs sont Booleens. 

21. Le dispositif selon la revendication 20, dans lequel 20 
ladite valeur comprend un identificateur de carac- 
tere joker. 

22. Le dispositif selon la revendication 15, dans lequel 
lesdits moyens d'acceptation de I'entr6e utilisateur 25 
comprennent en outre : 

des moyens pour effectuer une analyse desdits 
evenements en des elements standardises. 

30 

23. Le dispositif selon la revendication 21 , dans lequel 
lesdits moyens d'application comprennent en 
outre : 

des moyens pour utiliser lesdits num6ros de s6- 35 
quence pour faire une recherche dans lesdites 
entrees de filtre; 

des moyens pour adapter lesdits types d'ele- 
ment et lesdites valeurs a un type et a une va- 40 
leur particuliers d'6lement; 

des moyens pour interpreter lesdits identifica- 
teurs de caractere joker. 

45 

24. Le dispositif selon Tune quelconque des revendica- 
tions 15 a 23, comprenant en outre : 

des moyens pour accepter comme entree un 
schema dissociation d'action cree par I'utilisa- 50 
teur, ledit schema dissociation d'action 6tant 
utilise pour construire une table d'action (37); 



22 

lesdites actions particulieres, lesdites actions 
particulieres 6tant d6terminees par comparai- 
son des caracteristiques dudit groupe d'evene- 
ments avec une information contenue dans la- 
dite table d'action; 

des moyens pour envoyer lesdites actions par- 
ticulieres a un programme d'application pour 
continuer le traitement. 

25. Le dispositif selon la revendication 24, dans lequel 
une destination desdits moyens pour envoi est une 
person ne plac6e a une adresse eiectronique sur un 
systeme d'ordinateur. 

26. Le dispositif selon la revendication 24, dans lequel 
lesdits moyens de construction de table d'action 
comprennent en outre des moyens pour : 

accepter l'entr£e utilisateur pour cr6er et modi- 
fier ledit schema dissociation d'action; et 

effectuer une analyse sur ladite entree utilisa- 
teur en une representation specifique au dispo- 
sitif. 

27. Le dispositif selon la revendication 26, dans lequel 
lesdits moyens de construction de table d'action 
comprennent en outre des moyens pour : 

envoyer une pluralite d'entrees de groupe dans 
une table d'action. 

28. Le dispositif selon la revendication 27, dans lequel 
lesdits moyens d'introduction d'entr6es de groupe 
comprennent en outre des moyens pour : 

ajouter un identificateur de groupe et des ac- 
tions a chacune desdites entrees de groupe. 

29. Le dispositif selon la revendication 28, dans lequel 
lesdits moyens de determination desdites actions 
particulieres comprennent en outre des moyens 
pour: 

utiliser lesdits identificateurs de groupe pour ef- 
fectuer une recherche dans lesdites entrees de 
groupe; et 

adapter ledit identificateur de groupe a un grou- 
pe particulier. 
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des moyens pour recevoir comme entr6e un 
groupe d'ev6nements; ss 

des moyens pour appliquer ledit groupe d'6v6- 
nements a ladite table d'action pour determiner 
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